5119 matches found
VulnCheck KEV: CVE-2021-30120
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user...
VulnCheck KEV: CVE-2022-35526
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 login.cgi has no filtering on parameter key, which leads to command injection in page /login.shtml...
VulnCheck KEV: CVE-2021-30554
Google Chromium WebGL contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge,...
VulnCheck KEV: CVE-2021-33739
Microsoft Desktop Window Manager DWM Core Library contains an unspecified vulnerability that allows for privilege escalation...
VulnCheck KEV: CVE-2021-21224
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge,...
VulnCheck KEV: CVE-2021-20028
SonicWall Secure Remote Access SRA products contain an improper neutralization of a SQL Command leading to SQL injection...
VulnCheck KEV: CVE-2021-21315
In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote...
VulnCheck KEV: CVE-2021-25296
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server...
VulnCheck KEV: CVE-2021-29003
Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sysconfigvalid.xgi, as demonstrated by the sysconfigvalid.xgi?exeshell=%60telnetd%20%26%60 URI...
VulnCheck KEV: CVE-2021-21975
Server Side Request Forgery SSRF in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials...
VulnCheck KEV: CVE-2021-30665
Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products...
VulnCheck KEV: CVE-2021-24295
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The updatelog function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be...
VulnCheck KEV: CVE-2021-30663
Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple...
VulnCheck KEV: CVE-2020-10148
SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands...
VulnCheck KEV: CVE-2021-28799
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device...
VulnCheck KEV: CVE-2021-20016
SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker...
VulnCheck KEV: CVE-2021-30661
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and...
VulnCheck KEV: CVE-2020-16846
SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API...
VulnCheck KEV: CVE-2021-20022
SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and...
VulnCheck KEV: CVE-2021-31956
Microsoft Windows New Technology File System NTFS contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application...
VulnCheck KEV: CVE-2021-27104
Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints...
VulnCheck KEV: CVE-2021-28310
Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation...
VulnCheck KEV: CVE-2018-7314
SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-6429...
VulnCheck KEV: CVE-2018-9118
exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename parameter...
VulnCheck KEV: CVE-2013-1599
A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04US, DCS-2102/2121 1.05RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410...
VulnCheck KEV: CVE-2019-17554
The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks...
VulnCheck KEV: CVE-2015-7808
The vBApiHook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments...
VulnCheck KEV: CVE-2020-27615
The Loginizer plugin before 1.6.4 for WordPress allows SQL injection with resultant XSS, related to loginizerloginfailed and lzvalidip...
VulnCheck KEV: CVE-2019-0606
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'...
VulnCheck KEV: CVE-2020-12720
vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control...
VulnCheck KEV: CVE-2019-0192
In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side...
VulnCheck KEV: CVE-2015-1635
Microsoft HTTP protocol stack HTTP.sys contains a vulnerability that allows for remote code execution...
VulnCheck KEV: CVE-2019-8942
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted...
VulnCheck KEV: CVE-2020-12812
Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication FortiToken if they change the case in their username...
VulnCheck KEV: CVE-2021-24204
In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget includes/widgets/accordion.php accepts a ‘titlehtmltag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send...
VulnCheck KEV: CVE-2020-26919
Netgear JGS516PE devices contain a missing function level access control vulnerability...
VulnCheck KEV: CVE-2021-22502
Micro Focus Operation Bridge Report OBR contains an unspecified vulnerability that allows for remote code execution...
VulnCheck KEV: CVE-2021-27085
Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution...
VulnCheck KEV: CVE-2021-26411
Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption...
VulnCheck KEV: CVE-2021-24175
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user including admin by just providing the related username, as well as create accounts with...
VulnCheck KEV: CVE-2021-26855
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain...
VulnCheck KEV: CVE-2021-27065
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain...
VulnCheck KEV: CVE-2021-21972
VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system...
VulnCheck KEV: CVE-2018-13374
Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server...
VulnCheck KEV: CVE-2013-3896
Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application...
VulnCheck KEV: CVE-2017-16238
Tgsoft Vir.itexplorer arbitrary write kernel vulnerability via 0x82730080 ioctls...
VulnCheck KEV: CVE-2015-1000013
Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1...
VulnCheck KEV: CVE-2021-1871
Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing...
VulnCheck KEV: CVE-2021-21148
Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome,...